CVE-2026-1468CWE-352csrf

CVE-2026-1468

published March 6, 2026

CVSS
5.1
EPSS
0%
Percentile
11.4
In the wild
Unconfirmed
What it is

QuickCMS is vulnerable to Cross-Site Request Forgery across multiple endpoints. An attacker can craft special website, which when visited by the victim, will automatically send a POST request with victim's privileges.

This software does not implement any protection against this type of attack. All forms available in this software are potentially vulnerable.

This issue was fixed in a patch to version 6.8 published on 14.05.2026, deployments without this patch are still vulnerable

The record
Technical detail
CVSS
5.1 · NONE
CVSS v4.0
Not supplied
EPSS
0.00216 · 11.4th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2026-03-06T16:16Z
References (2)
https://cert.pl/posts/2026/03/CVE-2026-1468 · [email protected]https://opensolution.org/cms-system-quick-cms.html · [email protected]
EPSS history
Timeline
  • 06 MAR 11:04Z
    Cross-Site Request Forgery in QuickCMS
    cvelistv5